ae22c718159640f206efa4de45c8cb7471e4cd588b7d6a40603d192754d76c79

Analysis

max time kernel
3s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
creditstacks.com_chromes.exe
Size 50KB
Sample260504-jlehtad16w
SHA256 ae22c718159640f206efa4de45c8cb7471e4cd588b7d6a40603d192754d76c79
MD5 67dc4091747eca834817fad076e93293
SHA1 0978ad006559ddd35d29dbe01db3ec97a3053861
SHA512 a87676ab647e8a96a3ba6de98dbbeb2f292128b4d56ed9fe989d655c62b23348f67096ec8b45eb577f0d8bee251b8781dcfe279de17f2b08ba836e420989cf58
SSDEEP 768:tQdbtbIFDwOKIZ6JrubaO1WJnuq/Z/Rgr48C1XXGblfpp37KFc5x9:+bOZwV18v1WPZGr48EXGblfL37uc5
TLSH
T17633F70477F94211F1BF4ABA8DB192019B31B8979C22D78E07D5058E1AB3780DEE8F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/3052-0-0x0000000000190000-0x00000000001A2000-memory.dmp	disable_win_def
behavioral2/files/0x001400000002b8d8-2543.dat	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3936	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	creditstacks.com_chromes.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
276	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4112	tasklist.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2196	sc.exe
836	sc.exe
4988	sc.exe
2024	sc.exe
4292	sc.exe
1580	sc.exe
1188	sc.exe
2656	sc.exe
4804	sc.exe
880	sc.exe
4876	sc.exe
1492	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1732	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4292	NETSTAT.EXE
3100	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2716	systeminfo.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4620	vssadmin.exe
4392	vssadmin.exe
3268	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\ms-settings\shell\open\command	creditstacks.com_chromes.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\ms-settings	creditstacks.com_chromes.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\ms-settings\shell	creditstacks.com_chromes.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\ms-settings\shell\open	creditstacks.com_chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\creditstacks.com_chromes.exe"	creditstacks.com_chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\ms-settings\shell\open\command\DelegateExecute	creditstacks.com_chromes.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3100	schtasks.exe
4156	schtasks.exe
3216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3936	powershell.exe
4252	chrome.exe
4252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4252	3052	creditstacks.com_chromes.exe	80
PID 4252 wrote to memory of 2836	4252	chrome.exe	81
PID 3052 wrote to memory of 3936	3052	creditstacks.com_chromes.exe	82
PID 3052 wrote to memory of 4292	3052	creditstacks.com_chromes.exe	172
PID 3052 wrote to memory of 1492	3052	creditstacks.com_chromes.exe	86
PID 3052 wrote to memory of 1580	3052	creditstacks.com_chromes.exe	88
PID 3052 wrote to memory of 1188	3052	creditstacks.com_chromes.exe	90
PID 3052 wrote to memory of 2196	3052	creditstacks.com_chromes.exe	92
PID 3052 wrote to memory of 836	3052	creditstacks.com_chromes.exe	94
PID 3052 wrote to memory of 2656	3052	creditstacks.com_chromes.exe	96
PID 4252 wrote to memory of 4632	4252	chrome.exe	98
PID 4252 wrote to memory of 4632	4252	chrome.exe	98
PID 4252 wrote to memory of 1732	4252	chrome.exe	99
PID 4252 wrote to memory of 3552	4252	chrome.exe	100
PID 4252 wrote to memory of 3552	4252	chrome.exe	100
PID 4252 wrote to memory of 788	4252	chrome.exe	102
PID 4252 wrote to memory of 788	4252	chrome.exe	102
PID 4252 wrote to memory of 224	4252	chrome.exe	103
PID 4252 wrote to memory of 224	4252	chrome.exe	103
PID 3052 wrote to memory of 4804	3052	creditstacks.com_chromes.exe	101

C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe
"C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe"
1⤵
- Drops file in Drivers directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://creditstacks.com
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe37afc728,0x7ffe37afc734,0x7ffe37afc740
    3⤵
    PID:2836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,15150449356843371679,4017230849849561336,262144 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:4632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1440,i,14439417650742985498,3308300283712285480,524288 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2240 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,12416388229809681188,4160855230126514675,524288 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2308 /prefetch:13
    3⤵
    PID:3552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,15999527345445119977,6192867440040809866,2097152 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,8787945486546308003,13664783716450090493,2097152 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3960,i,9966394617666394743,12032140360695012889,2097152 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:9
    3⤵
    PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,8662157084994804454,14320884611372454587,524288 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:1592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5496,i,3352839010139010279,8444365769548235288,2097152 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:1392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,17478123072907645127,11032545394256219785,524288 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5652 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,6787146666703997790,2141255995647142079,524288 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:4392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5236,i,10624017273589182914,2981193806551809182,524288 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4500,i,8433800231877504087,7935205980249909929,262144 --field-trial-handle=1972,i,13062209092404452424,327674789210910299,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5692 /prefetch:10
    3⤵
    PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3936
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:4292
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1492
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:1580
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:1188
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:2196
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:836
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:2656
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4804
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3864
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:880
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4988
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4620
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:4376
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  PID:3860
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3100
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe" /sc minute /mo 30 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4156
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3696
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:4960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:2024
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4392
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:276
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  PID:1512
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3268
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:5252
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:2024
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  PID:1524
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2716
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  PID:1232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  PID:2392
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:4304
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  PID:4728
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:2764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:1180
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  PID:4692
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  PID:2020
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:4292
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:4876
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3216
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  PID:2704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4196

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2904

C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe
C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe
1⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe
C:\Users\Admin\AppData\Local\Temp\creditstacks.com_chromes.exe
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 68KB
SHA256 f835162f1fdf36ca18e0d295fe35aaae8ec8954ba58f73977eaf9181069826b8
MD5 597f74bf0398ce9b82dd6b915519867c
SHA1 51628288835e91abaac8f39ed324ac77f57d263d
SHA512 dc20453b4104ed01d25a14dd76e1443205e930f9b86ae4df0f01c177e2ca5aea6385374ef1d3272ed08cd90c1e6c274c28d5ff4603f54a0f3556ed63600ffa32
SSDEEP 1536:mBUMOowbx7X6owG4V1ijnbzwF7lWuIeVEZErL1vc140zzOCBV1KYfv514Gbnej:mBUfdbxTx4V1unQ7ouI2/1Ue0zzd1J5Q
TLSH
T189632A368B23FDC4677F2D40E06439971C883F2787B5267CFA850DA619E6684DF2E498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 67KB
SHA256 68e85e945fc4abae2fa2cac4c63d2261264c3638244a1ce8d1f6b484df09b342
MD5 cc5e56dd00103c9734b1db6976e7b914
SHA1 f7f0466a0ba851aed9aedd5149c45f7f3c821440
SHA512 a194972f58a7b5e5b15d04b2c9266e462992c939aa89ea8abab521edaa5edf02721bd77c27b8019cd37625fcdaf77b57d64c8d28cf38989dc216b63651e2cb32
SSDEEP 1536:GBUMOowbx7X6owG4V1ijnbzwF7lWuIeVEZErL1vc140zzOCBV1KYfv514Gbne6:GBUfdbxTx4V1unQ7ouI2/1Ue0zzd1J5L
TLSH
T13F6319368B23FDC4677F3D80E06439971C883E278775267CFA850DA619E6684DF2E498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2ab0d7b500b3cba79727b830a5d0d424955e9fcf95c19d3f93537035b3935d14
MD5 62fb44bd2bcf6af167e8b26979cb9ff9
SHA1 8e280abcb005fefacea6ab39f72ea5baa4aad61f
SHA512 ef22d55379b2d58b5e007f111041c3a8f3d6e0796d1fb660e069d3b6c709c96ae9f0650d7f649d8f0876041553867caf375855365e3c03f4678757423e98060e
TLSH
T19FE02BABED719C2719FD4B2950604746E751139B2B50545F363CC2088FF1A2B464689C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 384B
SHA256 2a4468f5b9f6cceaf0b5981487a98a31889fd93b0238a8514cbbb77e66e1f3a8
MD5 ab8a43eb8689e6ff970b25756a815cd3
SHA1 c6fc3763771f396cbc7437369822f6a887adf7bc
SHA512 abef86c3306358672d900c3c0fe1025c76c4d0eb1d95fb83e16c5483a80a67861448c5c421ea79aff1ab11a5ed6f875ba1fc384f9945f37af15b395ef819280e
TLSH
T1B8E08C2282C02882DB994E71088A3F10B62D868811070ABF13468A78BA67BE6C7D44E6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 9edfdeef890e55eb27869dc0b7f1149df0bd8bdaa83bb7e20edff4a4ffb6cf23
MD5 87ecbbc9913dcda7d1cec6c06c5d7206
SHA1 0689ed1cee5eb569d1ac7979c251d9487c6beb49
SHA512 2438ebf855db95ff68b8f191331b1cc5732769ac503dc76e13e35640d80fb344a305aa02d33a9d52994a1593769bc9830832af39e1d34cfbc38190a6db9da6d7
TLSH
T1F9E0CD1392D02883DB5D4E7108C93F50B16D858C15070FBF5349497CBA63BD5C7D54DA
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 42ff1c23ac56cd020681b60b55d3cd8629509429308932942fb64e94e145835f
MD5 435ab7ffae6991f9a4d49986206d2e02
SHA1 6a7f0dbd6dde48e95aeb31764771b12623245bf3
SHA512 c72a0cf76d44fc07e30fb9df4e8ad0584a02e6ff82cfe5afc7603b26c91220fcda8007d3e4ad6f037a1a787872a8a04bfaff1b1c3a29ce90836f24c5a6f0abf0
SSDEEP 96:d5Il61/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0b4:bIle/tH+bF+UI3iWGVYWNkqp3N
TLSH
T1ADF32D1E6F743211CDBD923668E748A35D7CF02F871366C66C6104B5CEE2652B46C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c26a24e074fbb3aa312a3ec8938fbc0cc94d3e51893ec62f4fdeb3e2089f867d
MD5 8c55ae1e2c80ab2d52fe57039f3faf0b
SHA1 f0a41e6aad6b43e6cfa177ddd36d74f84c400286
SHA512 253319519ff623fbf5ced93d930721633278b8287abd3c9cb0dd2fe1c6c8af2c66a5153f127d3abfd305f09ca18f28871ae841711842e148f0e9a2dc9a0f746c
TLSH
T18A517BF3C7E8997E890157F4A7153F2ACD690A54532C3D56C8D4AE0F53E28B6E20054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d2fae8cfedbb01102ca3527a0b0a02d408710fda2e09d64d8ade646c325c6d97
MD5 9074e9e158a29e3bd74ac599bd02305e
SHA1 c59da5b6bee715d0ff6f58c5c6fed915af7d7eda
SHA512 a61d04a56c42d1d5556a198b866e725d3cc12ef6602e90c8ccdbe8ec8e46bb3ee03784de9cb5718a684cb10f3732764ac1676ec7284477b1afee3acd99d27328
TLSH
T1FD517BF3C7E8997E890157F4AB153F2ACD690A54532C3D56C8D4AE0F53E28B6E20054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 439cbbb8211bd650457c90976de871cd1e33318518aadd2835ce4ccc124ef6e0
MD5 ca395d9e5c96b13a615eb39177c58fb6
SHA1 94de42fe972b9f09c03572e69307c49eca16664c
SHA512 b0551bf6ae06ac2b6fc928684d84760b96f354feebda08076287cc7e93645eb3d914af58e3b4a36e39a9498be84eb3216bd7edce0b2f9566597b34f230e8eab8
SSDEEP 96:DF7PF7V8F7sTIaEagdNAKF7UF7EF7TF7ZF7YF7WpF7eQZF7Gi0F7J8IF7EyF77Jm:DxP8KTIaEagdNAKK+hP+sp7ZQi0n3Bbm
TLSH
T1D3C134F7C3E88A2D890195F4AB152E1BCE5D0958572C3D5BC8D4EE4B67E29B2E30064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bfd7c5177202d7819fc49d104c506898531e01bb90c511a7db453b2f01bf0b7e
MD5 f5a70969faaf3fc810453a237d09ab9a
SHA1 26888e9d6befd588a1dbec16fba4861b76197c5d
SHA512 aa730ddd6963afcdee832bced00f8cd6967c5f55ab202c979953f658aecd6598164170440bffea93f36082724d96bb9efd6551dbf42158f57ae1ee89e8a1a141
SSDEEP 192:NURXBbc8dD5pSe0v7HYpAPRp2I98HF9b+WNn+j4P3P2X1maVyIsnAUgtaJ:aRXBbcgVrwEUXT6ha4Pf2Xp8
TLSH
T1DB42C62EB910757B9CDBC62DF922B713EBF5202161902EC4E6FC8A1C15E76CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 0ae6566b0c04d69cd70c4ce61a0c1701fcf05f2063fd9f39cc3b5b85f46ec780
MD5 4f4aef2be9253ba92d97c327d179c551
SHA1 cf2851269825d484e32bfac5181fc40f2850b669
SHA512 d689ac01e620e8143c9edae6c661244d3d1876d999c713153b9a3c06a6a97db08b235fc1eaf60336b24e6b41a272423d8a290d2b7170652000b59e960e2ee832
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLc83yXODVw+ErU3L5HGcLRXU:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pP
TLSH
T1FD72F9676C4C9A770F94CACCDD27BA4FADB5024B65E9886443FA981A03D5BCB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt
Size 143B
SHA256 2f5330cf9fe8aeec2b0e8539d677bc961a944b2a3e40d0cc486e53392a73fedf
MD5 accbeaa02e833f889e31510a585278f5
SHA1 64fb8f082e26221d9f8f5ca52ede1de38ab29aae
SHA512 7ae2578282b11e2cfe86a9854366027370daa1fbedc9631cb1e21343251507e958481beb4e5b5e78d02c5523249c03e2b28deda63dae703ce56bfa10945f69a7
TLSH
T10CC08CEB2030401EF686FA822800616C82426A8C1D9C0830C9E0840A5125624B0D6E15
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59c411.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt~RFe59c411.TMP
Size 150B
SHA256 ec37ccc61ed78289d05d1ae8cd8cb3035a88faec16da61f1b5f935523cce1f67
MD5 f1fa0e92fff34a37b614d979a524ad45
SHA1 9be0e746873411c48c9e81932f79a1e37e2772a5
SHA512 0bbd55b036693e0ad74e1ece3339d34e38fd77b4413ea895876755a515b5dd61e8843a5c2a2b96e00013fc86b58dd59e4c17d3fd85febcaed7a822a277a182e6
TLSH
T15EC08CEB2130001EF682F5836810618C82526E8C0D8C083089E0B00A6135224B1EAE15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 72637d738877e6c8bc2f38d83acdf4bc42828e509ad2b31a9c2aca6609066eb1
MD5 16e7fb0adb9b40e4e38fbba9b172f6fc
SHA1 fe414a3e2242048f2854b84120180498e7060d9b
SHA512 bf6d9eeeb534fdd454aeb1d785103fabb5b519bc3c7c9ce7c48453765f44c23a55c01a9bd384a02a25f67afeab27c658662e4e0013cba797c7b78ec83d72cdde
TLSH
T191C01265C101F132C04A07B6909298DC725C5F24D609035862E85D3ADC3E232405715A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f2763551bb39f49a50aefa7100d5d78e1bbac71cd26872139584dcee7352dae3
MD5 fc689e73609ba1edd996999c36385346
SHA1 53ce4242e42ffac477023865a87e6b3600f03c66
SHA512 87eb8ab5e374d9f6764fb0eef36347f26f5aad351ed76ad8c4935c66077a4b3d6f5de108187b6bde9c322d9e3f5919d19182c0e2af7868b514b52ffab48c1fd5
TLSH
T13BB01252C4819112C44503711AC4849C3224FF15CA465303B1E41B42DC3A2644665160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589e10.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589e10.TMP
Size 96B
SHA256 2ade6a2416ea0970db61bce38da6170567c5c4a2dab6cb06a7f2661e116c1c34
MD5 9faeefa63ef09b0353eb6d250c00c3ec
SHA1 0e6c30664b2d5facd3a60543e9613154f8506c68
SHA512 87764b37ee02807b631095f0fe48b935971df0811df22360cd3c89e8c8f9412973df4e2115cba6c57171e7f802ea0a3b9e7aa4ebc3a8480c63e77df086331d1d
TLSH
T128B002B6C142625BC04B03F065B596F8B5B0DF35C643122393E05E6BDC29EB34975A61
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 fba70d9406d0c278febf8e9fdfed333df13b7ea1e4a9ef6a56039bdf5d017a66
MD5 1d4260d72c1858262a1dc050eb2c9981
SHA1 420ed0d0246b8d8050780d7e27fa4908365cc5f5
SHA512 2670c1f84b8f6ba7e56ea99b159de45f03ccd457275bed58b2bb2cf00587b90dad96b22c84284ce8f012d635a1c0ea4eb33ff574979ccfef2f95e96a004f7d59
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O43WVumOs/ne:1nbZeMrv/hGt4Ine
TLSH
T1F1D3874B3A743102EDE69A721CE051BB4E3CB16D8F1595D428B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 ac5970c2b98afd2af4660327bfc8b75c0320ee569621dcce3e8a2aa2f917c6ac
MD5 666af1826b107f193eb90dfe426f526e
SHA1 8ccd463facaeaf5b5065e539690d0acad7475340
SHA512 c01ec7c5aa6ad9c9a95d4aa894220686d7c1412533f2c8d382cd1d25db7ac201d1fc69dc68d4d97a1add647213593eadf11e3ca8d788f19e333dc3acd26b6181
SSDEEP 6144:ktqlBiyDMu8J3k7BUJc86HqU++JjcMW2VcVLw:flEN3k7GJc86H5OMWa
TLSH
T1081412A65F0B343221AC97A9201B7C5A46E38CCD1A1D2DFD02E15B7B09BB3D2735BC05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 d3400045ed2695e48e2bb6f600a52e7745faa1f693c3fa8faf4019bb81380df3
MD5 4ed165d59432708e72842246b29474d7
SHA1 1d05efa4904b736abd7488b425c9b81545e0adf9
SHA512 a72c32709546e644ae675e33ba61415e00bc31821f449929ddfcb4a753ac408c495124c1f1c89320898aa09c2fed70513d4b4cfc9e48e57934bad9a62eeb6cda
SSDEEP 6144:k/qlBiyDMu8J3k7BUJc86HqU++JjcMW2VcVLw:vlEN3k7GJc86H5OMWa
TLSH
T1F91412A65F0B343221AC97A9211B7C9E46E38CCD1A1D29FD12E15BBB05BB3D2735BC05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 823168080d44429d68e7fe1bd609eca968dfd475169620933da7fe172eac701e
MD5 82ed7aa9a87d24870ed168b7b3dac723
SHA1 b689afc9c213bbbc4d1f56492b478669a1e33409
SHA512 a1e1d3e86ea2bb9939bbe02db6f58c512b987e8e9377f7c00f8e2f0be7502dfb53a085e86d989ceab4f6ba0dab2cc94126f6800ebb90e7bdea7601cd29970385
SSDEEP 1536:wSRP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:z++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1029312B99A1E7D79236EC396A0179CAC88D3DCDE151411BC30C75F1E14BB392A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 b1e6ea13dfd0ce61670735fba1d5b5c7126e9850393994a5a470f1bdcd88a29d
MD5 3b404256c757db92dcfd4cbf79335064
SHA1 47d0bfccbc7fcfdd7db952e14c5a19a4aaae4c34
SHA512 6f5b62a17dec3f2226daec5295f10b0b2e3233b5eedc2a3440068090d5692841cc71c7f991aa1b80864373ec736c4e249b13e5491bb41d56fb6a35e444038ba1
SSDEEP 1536:+S3XP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN5:Lf++J3qUQm08KMWF0bFTcVHr6z+
TLSH
T16D9302B9AD1E7D3923ABD796A0039C9D8CD3DCCE1514157C31C79B0E14BA392930B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

creditstacks.com_chromes.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\creditstacks.com_chromes.exe.log
Size 660B
SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
MD5 284393596fdd49bebd7b861bf339b82d
SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
TLSH
T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_n3xnmnvo.zus.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3xnmnvo.zus.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 249B
SHA256 6ee02d70c7f78de9ed7829661aaa1957f79e2486e00ed89b9597210c8f653393
MD5 eede3102250f19cebd0e292ccc0d494d
SHA1 ab4dc243e9db84e16fc3ed24bbb4e43b90cde40b
SHA512 973197cf9035b6a8821676c611e8ca6152d0a2cfb36786f494914be14a4173d6376a7760ea5c08f967a17c801f8ff3622dbdf46e77df37be1e6615c5250bd439
TLSH
T157D0978BB20CCAA80000227B80F39D8EDDE4482C3B13BE70DEB0EC0D329088089F6043
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 250B
SHA256 68074c5af19eccae1379e3e61e6ff48cbcc90ddc42c340f562344fd88a84abfd
MD5 5ae7da0c6f4bcea52cc8437bfcc731d7
SHA1 ae4357b6fbfdee61d0276d2baf6eb3dd1d29bd54
SHA512 d044a43f0df34dbe388130e31179f4b1a235ad7ea6929ad672e15bb369f037b13ac61b6e40485de5da4b5550061fdd487e30b6e273c8cdd12d53122877984eee
TLSH
T179D0A59B714DC6690001527B40F39D4DDDD5455D3F13AE70DD75ED0D325144589F6543
MD5 SHA1 SHA512 TLSH

Submit Download

DecryptAllFiles.exe

Path C:\Users\Admin\Desktop\DecryptAllFiles.exe
Size 50KB
SHA256 ae22c718159640f206efa4de45c8cb7471e4cd588b7d6a40603d192754d76c79
MD5 67dc4091747eca834817fad076e93293
SHA1 0978ad006559ddd35d29dbe01db3ec97a3053861
SHA512 a87676ab647e8a96a3ba6de98dbbeb2f292128b4d56ed9fe989d655c62b23348f67096ec8b45eb577f0d8bee251b8781dcfe279de17f2b08ba836e420989cf58
SSDEEP 768:tQdbtbIFDwOKIZ6JrubaO1WJnuq/Z/Rgr48C1XXGblfpp37KFc5x9:+bOZwV18v1WPZGr48EXGblfL37uc5
TLSH
T17633F70477F94211F1BF4ABA8DB192019B31B8979C22D78E07D5058E1AB3780DEE8F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
MD5 20c351356d10acf150d790bfa940d4ca
SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
TLSH
T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
MD5 d7645147eacea72992c3efbc22e7a507
SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
TLSH
T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
MD5 ffbf3122b27f828d8fd3c577ccf970b0
SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
TLSH
T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2704-2567-0x000002BE97F50000-0x000002BE97FFF000-memory.dmp

Download

memory/2716-2598-0x0000022E476D0000-0x0000022E4777F000-memory.dmp

Download

memory/3052-89-0x000000001AE50000-0x000000001AEFF000-memory.dmp

Download

memory/3052-0-0x0000000000190000-0x00000000001A2000-memory.dmp

Download

memory/3052-183-0x0000000002500000-0x0000000002510000-memory.dmp

Download

memory/3052-2597-0x000000001B8B0000-0x000000001B8C2000-memory.dmp

Download

memory/3052-1-0x0000000002500000-0x0000000002510000-memory.dmp

Download

memory/3268-2568-0x00000156C3C20000-0x00000156C3CCF000-memory.dmp

Download

memory/3696-2445-0x0000016E73050000-0x0000016E73051000-memory.dmp

Download

memory/3696-2485-0x0000016E74DC0000-0x0000016E74E6F000-memory.dmp

Download

memory/3860-2407-0x00000273BF440000-0x00000273BF4EF000-memory.dmp

Download

memory/3864-388-0x00000255622B0000-0x000002556235F000-memory.dmp

Download

memory/3864-522-0x00000255622B0000-0x000002556235F000-memory.dmp

Download

memory/3936-1075-0x000001ABDADE0000-0x000001ABDADFC000-memory.dmp

Download

memory/3936-2584-0x000001ABC2020000-0x000001ABC20CF000-memory.dmp

Download

memory/3936-2497-0x000001ABDAE10000-0x000001ABDAE1A000-memory.dmp

Download

memory/3936-790-0x000001ABDAB80000-0x000001ABDAB8A000-memory.dmp

Download

memory/3936-350-0x000001ABDABB0000-0x000001ABDAC63000-memory.dmp

Download

memory/3936-15-0x000001ABC2520000-0x000001ABC2542000-memory.dmp

Download

memory/3936-2484-0x000001ABDADD0000-0x000001ABDADD8000-memory.dmp

Download

memory/3936-2411-0x000001ABDAE20000-0x000001ABDAE3A000-memory.dmp

Download

memory/3936-2207-0x000001ABDADC0000-0x000001ABDADCA000-memory.dmp

Download

memory/3936-92-0x000001ABC24D0000-0x000001ABC24E2000-memory.dmp

Download

memory/3936-90-0x000001ABC2020000-0x000001ABC20CF000-memory.dmp

Download

memory/3936-2494-0x000001ABDAE00000-0x000001ABDAE06000-memory.dmp

Download

memory/3936-337-0x000001ABDAB90000-0x000001ABDABAC000-memory.dmp

Download

memory/4112-2594-0x00000197B96C0000-0x00000197B976F000-memory.dmp

Download

memory/4196-31-0x00000281C2410000-0x00000281C24BF000-memory.dmp

Download

memory/4392-2518-0x000002902FC30000-0x000002902FCDF000-memory.dmp

Download

memory/4392-2508-0x000002902FC30000-0x000002902FCDF000-memory.dmp

Download

memory/4620-928-0x0000023461510000-0x00000234615BF000-memory.dmp

Download

memory/4620-517-0x0000023461510000-0x00000234615BF000-memory.dmp

Download

memory/4780-835-0x0000016692180000-0x000001669222F000-memory.dmp

Download